Find the Hidden NTLM Fallback in Your AD Forest with Linda Taylor, Principal Software Engineer at Microsoft
Show notes
NTLM is an antique authentication protocol. It’s older than Active Directory. It’s easily exploited. And it’s being used in your forest all the time—very possibly without your knowledge.
Recorded live at the 2026 Hybrid Identity Protection Conference in Nashville, this episode features Linda Taylor, Principal Software Engineer at Microsoft. Linda explains why NTLM's security weaknesses and constant stream of reported vulnerabilities make it costly and risky to maintain. Even so, Kerberos still quietly falls back to it through local accounts, IP address connections, and hard-coded apps. Linda offers security teams a pathway out, walking through the new enhanced NTLM auditing in Windows Server 2025 and making the case that getting rid of NTLM is everyone's problem.
Linda joined Microsoft as an intern the year Active Directory shipped and spent 16 years as an Escalation Engineer in Microsoft Enterprise Support before moving to the Windows Server AD development team. She now leads work on NTLM deprecation and helped deliver AD security features that shipped in Windows Server 2025.
Guest Bio A Principal Software Engineer with 22 years in the Active Directory field, Linda started at Microsoft when AD shipped in 2000 as a university student intern. She spent 16 years in Microsoft Enterprise Support (CSS) as an Escalation Engineer working directly with customers solving and debugging deeply technical Active Directory problems. Six years ago, she realized her dream of making an even bigger impact on AD and joined the Windows Server Active Directory development team.
Linda has been working on AD bug fixes, security updates, and designing and implementing new AD and security related features that shipped in Windows Server 2025 and beyond.
Guest Quote “I want people to know that reducing NTLM is everyone's responsibility. It's not just the responsibility of the AD guy, Microsoft, or one team in your organization.”
Timestamps 01:29 Meet Linda Taylor 02:57 What Is NTLM? 03:46 Why Microsoft Deprecated NTLM 06:18 Enhanced NTLM Auditing in Windows Server 2025 08:20 What an NTLM Usage Poll Revealed 10:50 IAKerb and LocalKDC 14:45 NTLM Off by Default 16:07 Why NTLM Is Everyone's Problem 17:06 Conclusion and Final Thoughts
Sponsor The HIP Podcast is brought to you by Semperis, the identity-driven cyber resilience and crisis management company trusted by the world’s largest enterprises and government agencies to protect critical identity systems. Purpose-built for multi-cloud and hybrid identity environments—including Active Directory, Entra ID, Okta, and Ping Identity—Semperis helps organizations prevent, detect, respond to, and recover from identity-based cyberattacks. Visit semperis.com to learn more.